You can build a beautiful payment flow in a fortnight. Getting legal permission to move someone's money takes considerably longer, and almost all of that time goes into one question: is this person who they claim to be?
The three things you actually have to prove
Identity verification in a Sri Lankan financial product decomposes into three separate proofs, and teams routinely conflate them.
- The document is real. The NIC or passport presented has not been fabricated or altered.
- The person is the document holder. A liveness check or biometric match ties the human to the document.
- The account belongs to them. A bank account or wallet in the same verified name, proven by a micro-deposit or a bank-side lookup.
Skip any one of these and you have a gap a fraudster will find. Do all three badly and you have an onboarding funnel nobody completes.
Consent is not a checkbox
Under the Personal Data Protection Act, checking someone's NIC against a government register is processing personal data, and it needs a lawful basis. In practice that means a specific, recorded, revocable consent — captured before the lookup, tied to that lookup, and auditable afterwards.
The verification call should be incapable of running without a matching consent record. Not discouraged from running — incapable.
The pattern we use is a one-time consent link. The user receives an SMS or email, reads exactly what will be checked and by whom, and grants consent on a page that records the timestamp, the purpose and the IP address. It is more work than a checkbox, and it is the difference between a system that survives an audit and one that does not.
Storing what you learn
Once you have verified an NIC you are holding a national identifier for a real person. It should be encrypted at rest with a rotatable key, searchable only through a peppered blind index, and never written in plaintext — not to application logs, not to error traces, not to your analytics pipeline.
Why this is the bottleneck
None of the above is technically hard. It is slow because it requires agreements with data holders, legal review of consent language, and a security posture you can defend to a bank's vendor-assessment team. Teams that plan for it in month one ship. Teams that treat it as an integration detail spend a year in review.